namespace SV_TAINTED_DEREF {
﻿#include <sys/ipc.h>
#include <sys/shm.h>
#include <string.h>

#define SHMEM_SIZE 1024

typedef struct  S_{
	  int  transaction_id;
	  int* id;
	 char* str;
} S;

void  use_shared_mem_example(key_t shmem_key, int  id) {
	int  shmem_id = shmget(shmem_key, SHMEM_SIZE, IPC_CREAT);
	S* s = (S*)shmat(shmem_id, NULL, 0);
	if  (s != (S*)(-1)) {
		*(s->id) = id;                               // dereference of untrusted pointer, flagged as SV.TAINTED.DEREF
		strcpy(s->str, "Sample signal string");      // dereference of untrusted pointer via call, flagged as SV.TAINTED.CALL.DEREF
	}
	shmdt((void*)s);
}




#include <string.h>

typedef struct  {
		void   * data;
} request_t;

#define MAGIC_ADDRESS ((void*)0xdeadbeef)
#define MAGIC_SIZE 1024

char* get_sensitive_data();
void* read_from_port() {
	// a library function known to return pointer to untrusted data
	// for example, read from a fixed memory location
	return  MAGIC_ADDRESS;
}

void  unsafe_dereference() {
	request_t* req = read_from_port();
	char* data = get_sensitive_data();
	memcpy(req->data, data, MAGIC_SIZE);     // unsafe dereference inside the function, flagged by SV.TAINTED.CALL.DEREF
}
}}